Add grok patterns to support hostnames with underscores #35081
Labels
:Data Management/Ingest Node
Execution or management of Ingest Pipelines including GeoIP
>enhancement
Team:Data Management
Meta label for data/management team
Current
HOSTNAME
grok pattern doesn't support hostnames with underscores.As discussed in a PR to add this to the logstash plugin, the RFC doesn't accept underscores, but they are actually possible at least on Linux (see elastic/beats#8814), and when they are part of DNS records or in host:port patterns.
I think that
HOSTNAME
should accept underscores, or new patterns should be added to handle the cases where underscores could be present.The text was updated successfully, but these errors were encountered: